关联漏洞
标题：
N/A
(CVE-2025-1015)
描述：在 Thunderbird 地址簿 URI 字段中包含未经过滤的链接。攻击者可以利用此漏洞创建并导出一个地址簿，在其中的某个字段中包含恶意载荷。例如，在即时通讯部分的“其他”字段中。如果另一用户导入该地址簿，点击链接可能导致在 Thunderbird 内部打开一个网页，该网页可以执行（无特权的）JavaScript。此漏洞影响 Thunderbird 版本小于 128.7 的情况。
描述
an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript
介绍
CVE-2025-1015: Unsanitized address book fields on thunderbird thunderbird_esr128 and below
an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If another user imported the address book, clicking on the link could result in opening a web page inside Thunderbird, and that page could execute (unprivileged) JavaScript
<img width="412" alt="cve-new" src="https://github.com/user-attachments/assets/ca138a57-b042-4e26-8c38-9ed03bca50bf" />
文件快照
[4.0K] /data/pocs/c6d5b609391f4d24d41f7486894a0b68d0bebdde
├── [ 832] poc.py
└── [ 553] README.md
0 directories, 2 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。